Search code, repositories, users, issues, pull requests...

What's Changed

A hardening pass across the table, list, progress, and text packages,
fixing security issues, crash/race bugs, and performance problems in the
render hot paths, with benchmarks added to back the optimizations.

Security

table/list (HTML): escape the title, caption, and CSS class names in
RenderHTML() to prevent HTML/attribute injection.
table (CSV): make RenderCSV() output RFC 4180 compliant, and add an
opt-in Style().CSV.FieldProtection option that neutralizes spreadsheet
formula-injection fields (=, +, -, @, tab, CR).
text: sanitize hyperlink URLs and bound the escape-sequence parser
buffer so adversarial input can't grow it without limit.

Correctness

progress: fix a render panic on tiny tracker lengths, data races on
tracker/indicator state, and a leaked time.Ticker in the terminal-size
watcher.
table: guard auto-index rendering against empty maxColumnLengths.
text: prevent a panic in VAlign.Apply on negative maxLines.

Performance

table: compile regex filters once per render; pre-size render builders.
list: hoist repeated width math out of the render loops.
text: speed up Align.Apply and StringWidthWithoutEscSequences.
progress: build PacManChomp frames with a strings.Builder.

Tooling

Moved root-level benchmarks into their packages and wired up make bench;
added benchmarks for the table/text/list/progress render hot paths and tests
covering the retained-done-tracker render paths.

Full Changelog: jedib0t/go-pretty@v6.8.0...v6.8.1

`v6.8.0`

What's Changed

progress: fix speed decay on done trackers and log overwrite; fixes #405 by @jedib0t in #406
fix: wrap wide runes when wrapLen is odd in WrapHard by @koriyoshi2041 in #408

New Contributors

@koriyoshi2041 made their first contribution in #408

Full Changelog: jedib0t/go-pretty@v6.7.10...v6.8.0

`v6.7.10`

What's Changed

Fix panic on text align with unicode by @edznux-dd in #404

New Contributors

@edznux-dd made their first contribution in #404

Full Changelog: jedib0t/go-pretty@v6.7.9...v6.7.10

`v6.7.9`

What's Changed

table: markdown padding for human-friendly output; fixes #402 by @jedib0t in #403

Full Changelog: jedib0t/go-pretty@v6.7.8...v6.7.9

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

socket-security · 2026-04-02T21:48:07Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	github.com/jedib0t/go-pretty/v6@v6.7.8 ⏵ v6.8.1	⁺¹

View full report

sonarqubecloud · 2026-04-22T08:49:00Z

Quality Gate passed

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

sonarqubecloud · 2026-05-03T20:47:15Z

Quality Gate passed

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

sonarqubecloud · 2026-05-03T20:47:18Z

Quality Gate passed

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

sonarqubecloud · 2026-06-13T16:13:59Z

Quality Gate passed

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code